Before I go any further, show crypto isakmp has no results. But show crypto ipsec sa. Also, looks like the auth failed message is not there anymore in the logs. The tunnel is up! Could this indicate a success?
///////////////R1 (hub) /////////////////////////////////////////
SYD1PAXVR002#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
IPv6 Crypto ISAKMP SA
SYD1PAXVR002#show crypto ipsec profile ipsec4_prof
IPSEC profile ipsec4_prof
IKEv2 Profile: ikev4_prof
Security association lifetime: 4608000 kilobytes/3600 seconds
Dualstack (Y/N): N
Responder-Only (Y/N): N
PFS (Y/N): N
Mixed-mode : Disabled
Transform sets={
tfs4: { esp-256-aes esp-sha384-hmac } ,
}
SYD1PAXVR002#show crypto ipsec sa
interface: Tunnel11
Crypto map tag: Tunnel11-head-0, local addr 10.75.2.2
protected vrf: VRF-TUNNEL2
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 10.75.2.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 10.75.2.2, remote crypto endpt.: 10.75.2.1
plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/2
current outbound spi: 0xA682ACA0(2793581728)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x30A77BC2(816282562)
transform: esp-256-aes esp-sha384-hmac ,
in use settings ={Tunnel, }
conn id: 2326, flow_id: ESG:326, sibling_flags FFFFFFFF80004048, crypto map: Tunnel11-head-0, initiator : True
sa timing: remaining key lifetime (k/sec): (4608000/1738)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xA682ACA0(2793581728)
transform: esp-256-aes esp-sha384-hmac ,
in use settings ={Tunnel, }
conn id: 2325, flow_id: ESG:325, sibling_flags FFFFFFFF80004048, crypto map: Tunnel11-head-0, initiator : True
sa timing: remaining key lifetime (k/sec): (4608000/1738)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
SYD1PAXVR002#
///latest logs ////
Jun 19 22:11:11.088: IKEv2:(SESSION ID = 18530,SA ID = 2):Sending Packet [To 10.75.2.1:500/From 10.75.2.2:500/VRF i3:f3]
Initiator SPI : C0578C28121285F3 - Responder SPI : 21508F9228CACA2D Message id: 27
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
ENCR
Jun 19 22:11:11.088: IKEv2:(SESSION ID = 18530,SA ID = 2):Check for existing IPSEC SA
Jun 19 22:11:11.092: IKEv2:(SESSION ID = 18530,SA ID = 2):Received Packet [From 10.75.2.1:500/To 10.75.2.2:500/VRF i0:f3]
Initiator SPI : C0578C28121285F3 - Responder SPI : 21508F9228CACA2D Message id: 27
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:
Jun 19 22:11:11.092: IKEv2:(SESSION ID = 18530,SA ID = 2):parsing ENCR payload
Jun 19 22:11:11.092: IKEv2:(SESSION ID = 18530,SA ID = 2):parsing DELETE payload DELETE
Jun 19 22:11:11.092: IKEv2:(SESSION ID = 18530,SA ID = 2):Processing ACK to informational exchange
Jun 19 22:11:11.092: IKEv2:(SESSION ID = 18530,SA ID = 2):Check for existing IPSEC SA
Jun 19 22:33:21.935: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: g] [Source: 10.2.64.25] [localport: 22] at 08:33:21 AEST Thu Jun 20 2024
SYD1PAXVR002#
